CVE-2007-5393: xpdf

CVSS: 9.3v2.0HighModified

AliasesRHSA-2007:1028RHSA-2007:1051DEBIAN-CVE-2007-5393+1 more

Published 08-11-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-5393 is a high (CVSS 9.3) vulnerability in xpdf. EPSS estimates a 6.41% chance of exploitation in the next 30 days, higher than 93.6% of scored vulnerabilities.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.3/10

010

High · v2.0 (NVD)

EPSS score

6.41%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 17 · Related 2

DSA-1480-1 DSA-1509-1 DSA-1537-1 DTSA-85-1 DTSA-86-1 OPENSUSE-SU-2024:10707-1+11 more

Timeline

08-11-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.

CVSS metrics

1 score · 1 source · 1 version

v2.09.3

EPSS trend

Probability

6.41%

Chance of exploitation in the next 30 days

Percentile

94%

Versus all other CVEs

30-day change

0.00 pp

From 6.41% on 18-09-2026

18-09-202618-10-2026

EPSS score

6.41%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Affected systems

Redhat12 products

kdegraphics< 7:3.5.4-5.el5_1
kdegraphics-debuginfo< 7:3.5.4-5.el5_1
kdegraphics-devel< 7:3.5.4-5.el5_1
tetex< 0:1.0.7-38.5E.12 | < 0:1.0.7-67.11
tetex-afm< 0:1.0.7-38.5E.12 | < 0:1.0.7-67.11

Show all 12

Debian5 products

cups< 1.1.22-7
kdegraphics< 4:3.5.5-3etch2
libextractor< 0.5.12-1
poppler< 0.6.2-1
xpdf< 3.02-1.3

Xpdf1 product

xpdf3.02p11

3 vendors · 18 products

References

101 links

secunia.com/advisories/27579Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.novell.com/linux/security/advisories/2007_60_pdf.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/27632Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27743Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:222Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2007/3774VDB EntryX Refsource VUPEN
exchange.xforce.ibmcloud.com/vulnerabilities/38304VDB EntryX Refsource XF
secunia.com/advisories/27260Third Party AdvisoryX Refsource SECUNIAPatchVendor Advisory
secunia.com/advisories/27856Third Party AdvisoryX Refsource SECUNIA
support.novell.com/techcenter/psdb/da3498f05433976cc548cc4eaf8349c8.htmlX Refsource CONFIRM

Show all 100 references

secunia.com/advisories/27636Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/29604Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:223Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27721Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27724Third Party AdvisoryX Refsource SECUNIA
www.vupen.com/english/advisories/2007/3776VDB EntryX Refsource VUPEN
www.redhat.com/archives/fedora-package-announce/2007-November/msg00224.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27577Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/29104Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2007-November/msg00215.htmlVendor AdvisoryX Refsource FEDORA
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9839VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/27618Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27642Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/archives/fedora-package-announce/2007-December/msg00369.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27656Third Party AdvisoryX Refsource SECUNIA
secunia.com/secunia_research/2007-88/advisory/X Refsource MISCVendor Advisory
www.redhat.com/archives/fedora-package-announce/2007-November/msg00238.htmlVendor AdvisoryX Refsource FEDORA
support.novell.com/techcenter/psdb/1d5fd29802b2ef7e342e733731f1e933.htmlX Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2007-1026.htmlVendor AdvisoryX Refsource REDHAT
www.debian.org/security/2008/dsa-1509Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2007-1022.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/27573Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-1029.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/27641Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200805-13.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/28812Third Party AdvisoryX Refsource SECUNIA
www.debian.org/security/2008/dsa-1537Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/archives/fedora-package-announce/2007-November/msg00724.htmlVendor AdvisoryX Refsource FEDORA
www.redhat.com/support/errata/RHSA-2007-1031.htmlVendor AdvisoryX Refsource REDHAT
support.avaya.com/elmodocs2/security/ASA-2007-476.htmX Refsource CONFIRM
secunia.com/advisories/27772Third Party AdvisoryX Refsource SECUNIA
slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.761882Vendor AdvisoryX Refsource SLACKWARE
www.securityfocus.com/bid/26367VDB EntryX Refsource BID
secunia.com/advisories/27615Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-1021.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2007/3786VDB EntryX Refsource VUPEN
secunia.com/advisories/27645Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/archive/1/483372Mailing ListX Refsource BUGTRAQ
secunia.com/advisories/30168Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27574Third Party AdvisoryX Refsource SECUNIA
issues.rpath.com/browse/RPL-1926X Refsource CONFIRM
secunia.com/advisories/26503Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:219Vendor AdvisoryX Refsource MANDRIVA
www.debian.org/security/2008/dsa-1480Vendor AdvisoryX Refsource DEBIAN
security.gentoo.org/glsa/glsa-200711-22.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/27634Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:227Vendor AdvisoryX Refsource MANDRIVA
www.kde.org/info/security/advisory-20071107-1.txtX Refsource CONFIRM
secunia.com/advisories/28043Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27619Third Party AdvisoryX Refsource SECUNIA
www.mandriva.com/security/advisories?name=MDKSA-2007:220Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27705Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27578Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27640Third Party AdvisoryX Refsource SECUNIA
support.novell.com/techcenter/psdb/43ad7b3569dba59e7ba07677edc01cad.htmlX Refsource CONFIRM
www.redhat.com/support/errata/RHSA-2007-1023.htmlVendor AdvisoryX Refsource REDHAT
support.novell.com/techcenter/psdb/3867a5092daac43cd6a92e6107d9fbce.htmlX Refsource CONFIRM
secunia.com/advisories/27718Third Party AdvisoryX Refsource SECUNIA
security.gentoo.org/glsa/glsa-200711-34.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/27599Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/27575Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-1028.htmlVendor AdvisoryX Refsource REDHAT
www.securitytracker.com/id?1018905VDB EntryX Refsource SECTRACK
support.novell.com/techcenter/psdb/f83e024a65d69ebc810d2117815b940d.htmlX Refsource CONFIRM
www.redhat.com/archives/fedora-package-announce/2007-November/msg00663.htmlVendor AdvisoryX Refsource FEDORA
www.mandriva.com/security/advisories?name=MDKSA-2007:228Vendor AdvisoryX Refsource MANDRIVA
www.vupen.com/english/advisories/2007/3775VDB EntryX Refsource VUPEN
www.redhat.com/support/errata/RHSA-2007-1027.htmlVendor AdvisoryX Refsource REDHAT
www.redhat.com/support/errata/RHSA-2007-1030.htmlVendor AdvisoryX Refsource REDHAT
www.ubuntu.com/usn/usn-542-1Vendor AdvisoryX Refsource UBUNTU
secunia.com/advisories/27658Third Party AdvisoryX Refsource SECUNIA
www.redhat.com/support/errata/RHSA-2007-1024.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDKSA-2007:230Vendor AdvisoryX Refsource MANDRIVA
www.ubuntu.com/usn/usn-542-2Vendor AdvisoryX Refsource UBUNTU
www.redhat.com/support/errata/RHSA-2007-1025.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2007/3779VDB EntryX Refsource VUPEN
www.debian.org/security/2007/dsa-1408Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2007-1051.htmlVendor AdvisoryX Refsource REDHAT
www.mandriva.com/security/advisories?name=MDKSA-2007:221Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27553Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27637Third Party AdvisoryX Refsource SECUNIA
access.redhat.com/errata/RHSA-2007:1028Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=345121REPORT
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1028.jsonAdvisory
access.redhat.com/security/cve/CVE-2007-5393REPORT
www.cve.org/CVERecord?id=CVE-2007-5393Advisory
nvd.nist.gov/vuln/detail/CVE-2007-5393Advisory
access.redhat.com/errata/RHSA-2007:1051Advisory
security.access.redhat.com/data/csaf/v2/advisories/2007/rhsa-2007_1051.jsonAdvisory

Showing 100 of 101. Use Open JSON for the complete list.

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities